feat(permission): integrate auto-review and hard guards

pi-permission-system/test/composition-root.test.ts

@@ -51,14 +51,16 @@ const SERVING_REGISTRY_KEY = Symbol.for(
   "@gotgenes/pi-permission-system:serving-registry",
 );
 
-/** The six events the factory must register a handler for. */
+/** Events the factory must register a handler for. */
 const EXPECTED_HANDLERS = [
+  "agent_settled",
   "before_agent_start",
   "input",
   "resources_discover",
   "session_shutdown",
   "session_start",
   "tool_call",
+  "turn_start",
 ];
 
 let agentDir: string;
@@ -102,7 +104,7 @@ function writeProjectConfig(
   const dir = join(cwd, ".pi", "extensions", "pi-permission-system");
   mkdirSync(dir, { recursive: true });
   writeFileSync(
-    join(dir, "config.json"),
+    join(dir, "policy.jsonc"),
     `${JSON.stringify(config, null, 2)}\n`,
     "utf8",
   );